Open redirect (ARCH334)

Key dotnet.security.open-redirect · Severity warning · Category security · CWE CWE-601

Redirecting to a user-supplied URL without validation lets attackers send users to malicious sites, enabling phishing attacks.

Incorrect

public IActionResult Login(string returnUrl)
{
    return Redirect(returnUrl);
}

Correct

public IActionResult Login(string returnUrl)
{
    if (!Url.IsLocalUrl(returnUrl))
        return RedirectToAction("Index", "Home");

    return LocalRedirect(returnUrl);
}

Fix

Validate redirect targets with Url.IsLocalUrl or an allowlist; prefer LocalRedirect where possible.